# Summary
Unauthorized users can perform Arbitrary File Read and Deserialization
attack by submit job using restful api-v1.
# Details
Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit
job.
An attacker can set extra params in mysql url to perform Arbitrary File
Read and Deserialization attack.
This issue affects Apache SeaTunnel: <=2.3.10
# Fixed
Users are recommended to upgrade to version 2.3.11, and enable restful api-v2 & open https two-way authentication , which fixes the issue.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| http://www.openwall.com/lists/oss-security/2025/04/12/1 | Mailing List Third Party Advisory |
| https://github.com/apache/seatunnel/pull/9010 | Issue Tracking Patch |
| https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9 | Mailing List Vendor Advisory |
Configurations
History
08 Jul 2025, 13:05
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/apache/seatunnel/pull/9010 - Issue Tracking, Patch | |
| References | () http://www.openwall.com/lists/oss-security/2025/04/12/1 - Mailing List, Third Party Advisory | |
| References | () https://lists.apache.org/thread/qvh3zyt1jr25rgvw955rb8qjrnbxfro9 - Mailing List, Vendor Advisory | |
| CPE | cpe:2.3:a:apache:seatunnel:*:*:*:*:*:*:*:* | |
| First Time |
Apache seatunnel
Apache |
20 Jun 2025, 14:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE |
19 Jun 2025, 11:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-06-19 11:15
Updated : 2025-07-08 13:05
NVD link : CVE-2025-32896
Mitre link : CVE-2025-32896
JSON object : View
Products Affected
apache
- seatunnel
CWE
No CWE.